Overview

overview

10

Static

static

10

2025-02-21...er.exe

windows7-x64

1

2025-02-21...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-21_cccde67402c202b63f6b2fed46665dab_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250221-f97mqavkhj

  • MD5

    cccde67402c202b63f6b2fed46665dab

  • SHA1

    22ea5799ed13517eeacec091d22b6e0536ba3e75

  • SHA256

    3c0afc93f81a4e49bec77d7e5c3949919b8f1f15ee442f202f1c6b2b938094e9

  • SHA512

    70ca5c0430039f951a1d917678bcff6ecf6225d805bea5b826c4cd576d2ae83742a5328236bd1dd3655424ea6edd7418a008e188c414732c163f82fc58d7aefa

  • SSDEEP

    49152:BX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QF:BlRsZ47/QXoHUOfAoj1x6F

Score
10/10
meshagenttacticalrmm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.jcpit.support:443/agent.ashx

Attributes
  • mesh_id

    0x71B48526565D374C2E837811F4E1DD713F2405C3D769D6BD97761AAF939CB419E60396185E5B2DCF48400FBF85E74D39

  • server_id

    6383AD22F5F5535B311F51A18C2BF3AD9E56C2647AD51D62E04B3370E88280A139A4FE7EAB32E6A6BF993B13F6307D10

  • wss

    wss://mesh.jcpit.support:443/agent.ashx

Targets

    • Target

      2025-02-21_cccde67402c202b63f6b2fed46665dab_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      cccde67402c202b63f6b2fed46665dab

    • SHA1

      22ea5799ed13517eeacec091d22b6e0536ba3e75

    • SHA256

      3c0afc93f81a4e49bec77d7e5c3949919b8f1f15ee442f202f1c6b2b938094e9

    • SHA512

      70ca5c0430039f951a1d917678bcff6ecf6225d805bea5b826c4cd576d2ae83742a5328236bd1dd3655424ea6edd7418a008e188c414732c163f82fc58d7aefa

    • SSDEEP

      49152:BX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QF:BlRsZ47/QXoHUOfAoj1x6F

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks